Monitor the creation of monitor sessions

[lachlanpeters]

Hi All,

I am needing to find away to monitor if a monitor sessions is created/deleted or change.

Is there anyway that you know of to see that detail

[Panos Kampanakis]

What platform are you using?

You could monitor for syslog id "302013: Built {inbound|outbound} TCP connection_id..." and "302014: Teardown TCP connection id...".

If you are using an ASA then after version 8.2 you can use netflow to collect connection statistics with a neftlow collector.

I hope it helps.

PK

[lachlanpeters]

It is on a switch ( 2960, 3560 and 3750. All IOS at most 1 year old)

I am looking basically if anyone enters "monitor session........" a syslog event is triggered

Lachlan